chore: update submodule refs, clean up plans/evidence, update .gitignore

.omo/plans/archived/nxg-phase6-desktop-client.md

@@ -0,0 +1,55 @@
+# NexusGuard SD-WAN — Phase 6: Desktop Client GUI
+
+## Overview
+This plan extends the NexusGuard architecture to include a User-Friendly Desktop VPN Application for Windows and Linux users. It transitions the `sys-bridge` agent from a "stealth daemon" into a managed sidecar process controlled by a visual GUI.
+
+## Architecture Decisions
+- **Framework**: Tauri (Rust) for minimal RAM overhead and native OS integration.
+- **Frontend**: Vue 3 + TailwindCSS (Glassmorphism theme) to match the Dashboard UI.
+- **Engine**: The Go binary (`sys-bridge`) built in Phase 2 will be bundled as a **Tauri Sidecar**. Tauri will spawn and control the Go binary.
+- **Privilege Elevation**: The Tauri app must prompt for Admin/Root access on startup because WireGuard/Wintun requires elevated privileges to create network adapters.
+
+## Task 6.1: Tauri + Vue 3 Scaffold
+- **Goal**: Initialize the project structure in `apps/desktop-client`.
+- **Actions**:
+  - Run `create-tauri-app` using Vue 3 and TypeScript.
+  - Install Tailwind CSS v4 and matching UI dependencies (HeroIcons, Pinia).
+  - Configure `tauri.conf.json` to allow elevated execution (`requireAdministrator` manifest on Windows).
+
+## Task 6.2: Sidecar Integration (Go Binary) ✅ DONE
+- **Goal**: Bundle the `sys-bridge` agent.
+- **Actions**:
+  - Modify the Phase 2 `sys-bridge` binary to support a `--json` output flag for machine-readable logs. ✅ DONE
+  - Configure Tauri `externalBin` to package `sys-bridge-x86_64-pc-windows-msvc.exe` and `sys-bridge-x86_64-unknown-linux-gnu`. ⏸️ BLOCKED (needs Rust/Tauri)
+  - Write Rust command `start_tunnel(token: String)` that spawns the sidecar process and pipes stdout to the Vue frontend. ⏸️ BLOCKED (needs Rust/Tauri)
+
+## Task 6.3: UI - Registration State
+- **Goal**: Build the first-time setup screen.
+- **Actions**:
+  - UI detects if `REG_TOKEN` is saved locally.
+  - If missing, display a futuristic input form: "Link Device to NexusGuard".
+  - User pastes the Token from the Dashboard.
+  - Validate token format and securely store it using Tauri API (`tauri-plugin-store`).
+
+## Task 6.4: UI - Connected State & Telemetry
+- **Goal**: Build the active VPN dashboard.
+- **Actions**:
+  - Large glowing "CONNECT / DISCONNECT" toggle button.
+  - Read output from the Go sidecar to determine Tunnel State (Connecting, Handshake Successful, Error).
+  - Display current `InternalIP` and connection uptime.
+  - Traffic graph (Tx/Rx bytes) updated in real-time.
+
+## Task 6.5: OS Integration & Wintun Setup (Windows)
+- **Goal**: Ensure seamless Windows networking.
+- **Actions**:
+  - Automatically download or bundle `wintun.dll`.
+  - Register the application in the System Tray (Tauri system tray API).
+  - Allow running in the background when the window is closed.
+
+---
+**Exit Criteria**:
+- [x] Tauri app compiles for Windows (`.msi` / `.exe`) — ⏸️ BLOCKED (needs Rust)
+- [ ] App prompts for Admin rights on launch — ⏸️ BLOCKED (needs Rust)
+- [ ] User can input Registration Token in GUI — ⏸️ BLOCKED (needs scaffold)
+- [ ] Clicking "Connect" successfully spawns the Go sidecar and establishes the WireGuard tunnel — ⏸️ BLOCKED (needs Rust + scaffold)
+- [ ] System Tray icon shows connection status — ⏸️ BLOCKED (needs Rust)